Skip to content

Instantly share code, notes, and snippets.

@bcicen
Created December 16, 2013 20:41
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save bcicen/7993990 to your computer and use it in GitHub Desktop.
Save bcicen/7993990 to your computer and use it in GitHub Desktop.
Finds all readable regions of memory for a given pid and dumps them to stdout.
#! /usr/bin/env python
import re
import sys
if len(sys.argv) != 2 :
print "LEN = = " + str(len(sys.argv))
sys.exit(1)
else :
mypid=sys.argv[1]
mypid=str(mypid)
sys.stderr.write("PID = " + str(mypid) )
maps_file = open("/proc/"+mypid+"/maps", 'r')
mem_file = open("/proc/"+mypid+"/mem", 'r', 0)
for line in maps_file.readlines(): # for each mapped region
# m = re.match(r'([0-9A-Fa-f]+)-([0-9A-Fa-f]+) ([-r])', line)
# if m.group(3) == 'r': # if this is a readable region
m = re.match(r'([0-9A-Fa-f]+)-([0-9A-Fa-f]+) ([-r][-w])', line)
if m.group(3) == 'rw': # if this is a writeable region
sys.stderr.write("\nOK : \n" + line+"\n")
start = int(m.group(1), 16)
if start > 281474976710655 :
continue
end = int(m.group(2), 16)
sys.stderr.write( "start = " + str(start) + "\n")
mem_file.seek(start) # seek to region start
chunk = mem_file.read(end - start) # read region contents
print chunk, # dump contents to standard output
else :
sys.stderr.write("\nPASS : \n" + line+"\n")
maps_file.close()
mem_file.close()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment